35 of the 19,264 CVEs in the phpwarden feed are on CISA's Known Exploited Vulnerabilities catalogue: attackers are using them now, so they should be fixed first. Feed 2026.10.28.3, updated 2026-10-28; this page regenerates with every feed build.
| CVE | Package | Title | Severity | EPSS | KEV since |
|---|---|---|---|---|---|
| CVE-2026-109618 | PHP engine | Upload-progress use-after-free and remote process-memory disclosure | critical | 100% | 2026-10-26 |
| CVE-2026-109619 | PHP engine | Fatal-error backtrace use-after-free and OPcache type confusion | critical | 100% | 2026-10-26 |
| Package | Ecosystem | KEV CVEs | All advisories |
|---|---|---|---|
| drupal/core | Composer | 5 | 164 |
| craftcms/cms | Composer | 4 | 127 |
| drupal/drupal | Composer | 4 | 96 |
| PHP engine | PHP engine | 4 | 8 |
| magento/community-edition | Composer | 3 | 360 |
| WordPress core | WordPress | 2 | 345 |
| pear/archive_tar | Composer | 2 | 6 |
| magento/project-community-edition | Composer | 1 | 161 |
| magento/product-community-edition | Composer | 1 | 133 |
| laravel/framework | Composer | 1 | 38 |
| october/system | Composer | 1 | 25 |
| phpmailer/phpmailer | Composer | 1 | 14 |
| yiisoft/yii2 | Composer | 1 | 13 |
| roundcube/roundcubemail | Composer | 1 | 10 |
| vrana/adminer | Composer | 1 | 9 |
| duplicator (WordPress plugin) | WordPress | 1 | 8 |
| wp-file-manager (WordPress plugin) | WordPress | 1 | 8 |
| litespeed-cache (WordPress plugin) | WordPress | 1 | 7 |
| livewire/livewire | Composer | 1 | 7 |
| contact-form-7 (WordPress plugin) | WordPress | 1 | 6 |
| CVE | Package | Title | Severity | EPSS | KEV since |
|---|---|---|---|---|---|
| CVE-2026-109618 | PHP engine | Upload-progress use-after-free and remote process-memory disclosure | critical | 100% | 2026-10-26 |
| CVE-2026-109619 | PHP engine | Fatal-error backtrace use-after-free and OPcache type confusion | critical | 100% | 2026-10-26 |
| CVE-2026-60137 | WordPress core | WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in p | medium | 5% | 2026-07-21 |
| CVE-2026-63030 | WordPress core | WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which | critical | 11% | 2026-07-21 |
| CVE-2026-9082 | drupal/core | Drupal core includes a database abstraction API to ensure that queries executed against the database are sanitized to pr | critical | 89% | 2026-05-22 |
| CVE-2025-54068 | livewire/livewire | Livewire is vulnerable to remote command execution during component property update hydration | critical | 96% | 2026-03-20 |
| CVE-2025-32432 | craftcms/cms | Craft CMS Allows Remote Code Execution | critical | 100% | 2026-03-20 |
| CVE-2025-49113 | roundcube/roundcubemail | Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization | critical | 100% | 2026-02-20 |
| CVE-2025-54236 | magento/community-edition, magento/project-community-edition | Magento Community Edition Improper Input Validation vulnerability | critical | 95% | 2025-10-24 |
| CVE-2021-21311 | vrana/adminer | SSRF in adminer | high | 98% | 2025-09-29 |
| CVE-2016-10033 | phpmailer/phpmailer | Remote code execution via crafted Sender in the isMail transport | critical | 100% | 2025-07-07 |
| CVE-2025-35939 | craftcms/cms | Craft CMS stores arbitrary content provided by unauthenticated users in session files | medium | 1% | 2025-06-02 |
| CVE-2024-56145 | craftcms/cms | Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled | critical | 97% | 2025-06-02 |
| CVE-2024-58136 | yiisoft/yii2 | yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key | critical | 88% | 2025-05-02 |
| CVE-2025-23209 | craftcms/cms | Craft CMS has a potential RCE with a compromised security key | high | 22% | 2025-02-20 |
| CVE-2020-11023 | components/jquery | Potential XSS vulnerability in jQuery | medium | 85% | 2025-01-23 |
| CVE-2024-34102 | magento/community-edition, magento/product-community-edition | Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability | critical | 100% | 2024-07-17 |
| CVE-2024-4577 | PHP engine | PHP-CGI argument injection to RCE on Windows via Best-Fit encoding | critical | 100% | 2024-06-12 |
| CVE-2018-15133 | laravel/framework | Laravel Framework RCE Vulnerability | high | 77% | 2024-01-16 |
| CVE-2021-3129 | facade/ignition | Unauthenticated remote code execution via insecure file handling in debug mode | critical | 100% | 2023-09-18 |
| CVE-2020-36193 | pear/archive_tar | Directory Traversal in Archive_Tar | high | 71% | 2022-08-25 |
| CVE-2020-28949 | pear/archive_tar | Potential file overwrite if archive filename starts with file:// | unknown | 85% | 2022-08-25 |
| CVE-2018-7602 | drupal/core, drupal/drupal | A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows a | critical | 99% | 2022-04-13 |
| CVE-2019-6340 | drupal/core, drupal/drupal | Some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in s | high | 92% | 2022-03-25 |
| CVE-2019-11043 | PHP engine | PHP-FPM remote code execution via env_path_info buffer underflow | critical | 100% | 2022-03-25 |
| CVE-2022-24086 | magento/community-edition | Magento improper input validation vulnerability | critical | 99% | 2022-02-15 |
| CVE-2017-9841 | phpunit/phpunit | Code Injection in PHPUnit | critical | 100% | 2022-02-15 |
| CVE-2020-13671 | drupal/core, drupal/drupal | *Update November 18: Documented longer list of dangerous file extensions* Drupal core does not properly sanitize certai | high | 36% | 2022-01-18 |
| CVE-2021-32648 | october/system | Account Takeover in Octobercms | high | 90% | 2022-01-18 |
| CVE-2019-9978 | social-warfare (WordPress plugin), social-warfare-pro (WordPress plugin) | The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_optio | medium | 73% | 2021-11-03 |
| CVE-2020-25213 | wp-file-manager (WordPress plugin) | Unauthenticated arbitrary file upload to RCE via the elFinder connector | critical | 97% | 2021-11-03 |
| CVE-2020-11738 | duplicator (WordPress plugin) | The Snap Creek Duplicator plugin before 1.3.28 for WordPress (and Duplicator Pro before 3.8.7.1) allows Directory Traver | high | 98% | 2021-11-03 |
| CVE-2018-7600 | drupal/core, drupal/drupal | A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows a | critical | 100% | 2021-11-03 |
| CVE-2024-28000 | litespeed-cache (WordPress plugin) | Unauthenticated privilege escalation to administrator via weak hash in the crawler | critical | 68% | – |
| CVE-2020-35489 | contact-form-7 (WordPress plugin) | Unrestricted file upload via unsanitised filenames (double extension) | critical | 89% | – |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked